https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325939#M190756 <P>No I'm actually looking for all failed logins by users. &gt;10 was the most important part. Thanks</P> Fri, 21 Jul 2017 11:53:24 GMT mihall 2017-07-21T11:53:24Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325933#M190750 <P>How can I search for 10 failed logon attempts within a 5 minute timeframe?<BR />I could try timechart, but a 24 hour period does not allow the interval to be as small as 5 mins. I could also "stats count by user", but this does not show any aspect of time.</P> Thu, 25 Feb 2021 04:35:49 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325933#M190750 mihall 2021-02-25T04:35:49Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325934#M190751 <P>try this</P> <P>| timechart span=5m count(failed_logins) as failed_logins | where failed_logins &lt;=10</P> Tue, 29 Sep 2020 14:59:41 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325934#M190751 sbbadri 2020-09-29T14:59:41Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325935#M190752 <P>Like this:</P> <PRE><CODE>... | streamstats time_window=5m count(failed_logins) AS failed_logins BY user | where failed_logins &gt;=10 </CODE></PRE> Thu, 20 Jul 2017 20:11:38 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325935#M190752 woodcock 2017-07-20T20:11:38Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325936#M190753 <P>I think: <CODE>s/&lt;/&gt;/</CODE></P> Thu, 20 Jul 2017 20:13:07 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325936#M190753 woodcock 2017-07-20T20:13:07Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325937#M190754 <P>@woodcock - Since he mentioned <CODE>stats count by user</CODE> I think he wants ten failed logins for a single user...</P> Thu, 20 Jul 2017 22:10:32 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325937#M190754 DalJeanis 2017-07-20T22:10:32Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325938#M190755 <P>Updated, thank you @DalJeanis.</P> Thu, 20 Jul 2017 22:22:38 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325938#M190755 woodcock 2017-07-20T22:22:38Z https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325939#M190756 <P>No I'm actually looking for all failed logins by users. &gt;10 was the most important part. Thanks</P> Fri, 21 Jul 2017 11:53:24 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-Login-Failure-Attempts/m-p/325939#M190756 mihall 2017-07-21T11:53:24Z